fix: CSSTidy ImportantComments not handled properly

[Wolfrank1149]

Fix for issue #357

Added a check if $decls is an array before the foreach and not keeping the value if it's not.

Also added a unit test for that case.

[ezyang]

You are bypassing validation of style entirely, therefore introducing a security vulnerability here. You must still validate style.

[Wolfrank1149]

The validation is still done, I only skip it for the important comments. Do want me to also check them? If yes, do I validate them like a style or do you have a specifict validation for comments?

[ezyang]

Hmm, ok, so basically it sounds like what you are saying is the decls are string, they are comments? I think I would still feel more comfortable if we limit the valid contents of the comment. Can we allow only !important for your use case?

[Wolfrank1149]

Here the out put from print_r($this-_tidy->css) in ExtractStyleBlocks.php when I run the unit test I added.

(
    [!] => ! Important 
! Important2 
    [41] => Array
        (
            [div] => Array
                (
                    [text-align] => right
                )

        )
)

I also decided to simply remove the comments since they have no impact on the code. It's safer and easier to manage.

[ezyang]

thank you much appreciated

[ezyang]

Woops our ci is broken

[github-actions]

🎉 This PR is included in version 4.17.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀